new: [findip-host] New warning-list for known hostname used to lookup source IP of the resolver

2023-10-12 08:43:01 +02:00 · 2023-10-12 08:43:01 +02:00 · a92ef80539
parent e661c9ab92
commit a92ef80539
1 changed files with 16 additions and 0 deletions
--- a/lists/findip-host/list.json
+++ b/lists/findip-host/list.json
@ -0,0 +1,16 @@
+{
+  "description": "Event contains one or more entries of known hostname querying your source IP.",
+  "list": [
+    "whoami.akamai.net",
+    "ip.parrotdns.com",
+    "api.extralargecoffee.com"
+  ],
+  "matching_attributes": [
+    "domain",
+    "hostname",
+    "domain|ip"
+  ],
+  "name": "List of known hostname used for querying your source IP. This can be used as exclusion for your Passive DNS lookup.",
+  "type": "hostname",
+  "version": 1
+}